Buggy code:
@ ApiMethod ( name = "activityTypes.get" , path = "activity-types//{id}" , httpMethod = HttpMethod . GET ) public ActivityType getActivityType ( User caller , @ Named ( "id" ) Key id ) throws ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityTypes.update" , path = "activity-types//{id}" , httpMethod = HttpMethod . PUT ) public ActivityType updateActivityType ( User caller , @ Named ( "id" ) Key id , ActivityType activityType ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityTypes.add" , path = "activity-types" , httpMethod = HttpMethod . POST ) public ActivityType addActivityType ( User caller , JasAddActivityTypeRequest request ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityTypes.remove" , path = "activity-types//{id}" , httpMethod = HttpMethod . DELETE ) public void removeActivityType ( User caller , @ Named ( "id" ) Key id ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activities.query" , path = "activities" , httpMethod = HttpMethod . GET ) public List < Activity > getActivities ( User caller , @ Nullable @ Named ( "organizationId" ) Key organizationId , @ Nullable @ Named ( "activityTypeId" ) Key activityTypeId , @ Nullable @ Named ( "fromDate" ) final Date fromDate , @ Nullable @ Named ( "toDate" ) final Date toDate , @ Nullable @ Named ( "offset" ) Integer offset , @ Nullable @ Named ( "limit" ) Integer limit ) throws BadRequestException , NotFoundException { } @ ApiMethod ( name = "activities.get" , path = "activities//{id}" , httpMethod = HttpMethod . GET ) public Activity getActivity ( User caller , @ Named ( "id" ) Key id ) throws ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activities.update" , path = "activities//{id}" , httpMethod = HttpMethod . PUT ) public Activity updateActivity ( User caller , @ Named ( "id" ) Key id , Activity activity ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activities.add" , path = "activities" , httpMethod = HttpMethod . POST ) public List < Activity > addActivity ( User caller , JasAddActivityRequest request ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activities.remove" , path = "activities//{id}" , httpMethod = HttpMethod . DELETE ) public void removeActivity ( User caller , @ Named ( "id" ) Key id ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activitySubscriptions.add" , path = "activity-subscriptions" , httpMethod = HttpMethod . POST ) public Subscription addSubscription ( User caller , @ Named ( "userId" ) Key userId , @ Named ( "activityId" ) Key activityId ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { <START_BUG> mustBeSameUserOrAdmin ( caller , userId ) ; <END_BUG> try { return ActivityServiceFactory . getActivityService ( ) . subscribe ( userId , activityId ) ; } catch ( EntityNotFoundException e ) { throw new NotFoundException ( e . getMessage ( ) ) ; } catch ( UniqueConstraintException e ) { throw new BadRequestException ( e . getMessage ( ) ) ; } catch ( OperationException e ) { throw new BadRequestException ( e . getMessage ( ) ) ; } } @ ApiMethod ( name = "activitySubscriptions.query" , path = "activity-subscriptions" , httpMethod = HttpMethod . GET ) public Subscription getSubscription ( User caller , @ Named ( "userId" ) Key userId , @ Named ( "activityId" ) Key activityId ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activitySubscriptions.subscribers" , path = "activities//{id}//subscribers" , httpMethod = HttpMethod . GET ) public List < Subscription > getSubscriptions ( User caller , @ Named ( "activityId" ) Key activityId ) throws ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activitySubscriptions.cancel" , path = "activities//{id}//subscribers" , httpMethod = HttpMethod . DELETE ) public void cancelSubscription ( User caller , @ Named ( "subscriptionId" ) Key subscriptionId ) throws ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.query" , path = "activity-packages" , httpMethod = HttpMethod . GET ) public List < ActivityPackage > getActivityPackages ( User caller , @ Named ( "organizationId" ) Key organizationId ) throws NotFoundException { } @ ApiMethod ( name = "activityPackages.get" , path = "activity-packages//{id}" , httpMethod = HttpMethod . GET ) public ActivityPackage getActivityPackage ( User caller , @ Named ( "id" ) Key id ) throws ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.update" , path = "activity-packages//{id}" , httpMethod = HttpMethod . PUT ) public ActivityPackage updateActivityPackage ( User caller , @ Named ( "id" ) Key id , JasActivityPackageRequest request ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.add" , path = "activity-packages" , httpMethod = HttpMethod . POST ) public ActivityPackage addActivityPackage ( User caller , JasActivityPackageRequest request ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.remove" , path = "activity-packages//{id}" , httpMethod = HttpMethod . DELETE ) public void removeActivityPackage ( User caller , @ Named ( "id" ) Key id ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.getActivities" , path = "activity-packages-activity//{activityPackageId}" , httpMethod = HttpMethod . GET ) public List < Activity > getActivityPackageActivities ( User caller , @ Named ( "activityPackageId" ) Key activityPackageId ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.addActivity" , path = "activity-packages-activity//{activityPackageId}//{activityId}" , httpMethod = HttpMethod . POST ) public void addActivityToActivityPackage ( User caller , @ Named ( "activityPackageId" ) Key activityPackageId , @ Named ( "activityId" ) Key activityId ) throws BadRequestException , ForbiddenException , NotFoundException , UnauthorizedException { } @ ApiMethod ( name = "activityPackages.removeActivity" , path = "activity-packages-activity//{activityPackageId}//{activityId}"

Fix:
mustBeSameUserOrAdminOrOrgMember ( caller , userId , createFromActivityId ( activityId ) ) ;